CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard
Authenticated users can upload malicious SVGs to trigger stored XSS, potentially compromising other users' accounts and sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-34281?
CVE-2025-34281 is a medium-severity cross-site scripting vulnerability in thingsboard, published on 17 Oct 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.
Weakness: CWE-79
Which versions are affected by CVE-2025-34281?
2 open source packages ship an affected version, including org.thingsboard:application. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.thingsboard:application Maven | All versions | 4.2.1 |
org.thingsboard:application Maven | All versions | 4.2.1 |
Products include Thingsboard Thingsboard.
How do I fix CVE-2025-34281?
Upgrade org.thingsboard:application to 4.2.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-34281 being exploited?
There is no known exploitation of CVE-2025-34281 in the wild and no public exploit code.
Other vulnerabilities in thingsboard
Sources
Also known as GHSA-fpq4-r87v-g246.